revengerat | 82104a89b676d095f16da49490abfd6267a0eea6617d619d25416aaf423125ce

General

Target

rv.exe
Size

386KB
MD5

2602c258d3fe5647f4f039b644abeaa6
SHA1

f733131b769735c82c56dd5b3f6aef4e3cabac9b
SHA256

ab682dce500913302f75c0cccc9f049fc3fa70b16b5de99788fb9cd520f47d3d
SHA512

db0aa91cbf071fa12951a5b9eeb6610aea3917edd93465863cdeafb939cc5ac9088fee8f64e96d375a428f236bbb589953e60cef3ff50ae2697940d12eba90c6
SSDEEP

384:re6KdcoFfsOxQrSuxY8OR1XOg9rPdQ0qphKBXnMTismaFcwadkfLpOhqqSOpFC:+dcoFLxQrS0Yv5OaVQ52eisHcBKv2C

Score

10^/10

revengerat guest persistence trojan

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

awaisawan.zapto.org:333

Mutex

Random

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	rv.exe

Executes dropped EXE 1 IoCs

pid	Process
2968	svchsoot.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rv.exe"	rv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\svchsoot.exe"	svchsoot.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	rv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	svchsoot.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchsoot.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 2968	4320	rv.exe	97
PID 4320 wrote to memory of 2968	4320	rv.exe	97
PID 4320 wrote to memory of 2968	4320	rv.exe	97

C:\Users\Admin\AppData\Local\Temp\rv.exe
"C:\Users\Admin\AppData\Local\Temp\rv.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Users\Admin\AppData\Roaming\svchsoot.exe
  "C:\Users\Admin\AppData\Roaming\svchsoot.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks processor information in registry
  PID:2968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4212,i,11751898164297348119,13021661521765644467,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:8
1⤵
PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\svchsoot.exe

Filesize
386KB

MD5
2602c258d3fe5647f4f039b644abeaa6

SHA1
f733131b769735c82c56dd5b3f6aef4e3cabac9b

SHA256
ab682dce500913302f75c0cccc9f049fc3fa70b16b5de99788fb9cd520f47d3d

SHA512
db0aa91cbf071fa12951a5b9eeb6610aea3917edd93465863cdeafb939cc5ac9088fee8f64e96d375a428f236bbb589953e60cef3ff50ae2697940d12eba90c6

Download Submit
memory/2968-25-0x0000000074C70000-0x0000000075420000-memory.dmp

Filesize
7.7MB

Download
memory/2968-24-0x0000000074C70000-0x0000000075420000-memory.dmp

Filesize
7.7MB

Download
memory/2968-23-0x0000000074C70000-0x0000000075420000-memory.dmp

Filesize
7.7MB

Download
memory/2968-22-0x0000000074C70000-0x0000000075420000-memory.dmp

Filesize
7.7MB

Download
memory/4320-3-0x0000000074C7E000-0x0000000074C7F000-memory.dmp

Filesize
4KB

Download
memory/4320-6-0x0000000074C70000-0x0000000075420000-memory.dmp

Filesize
7.7MB

Download
memory/4320-7-0x0000000005AB0000-0x0000000006054000-memory.dmp

Filesize
5.6MB

Download
memory/4320-8-0x0000000074C70000-0x0000000075420000-memory.dmp

Filesize
7.7MB

Download
memory/4320-5-0x00000000053B0000-0x0000000005416000-memory.dmp

Filesize
408KB

Download
memory/4320-20-0x0000000074C70000-0x0000000075420000-memory.dmp

Filesize
7.7MB

Download
memory/4320-4-0x0000000005080000-0x000000000508C000-memory.dmp

Filesize
48KB

Download
memory/4320-0-0x0000000074C7E000-0x0000000074C7F000-memory.dmp

Filesize
4KB

Download
memory/4320-2-0x00000000050A0000-0x000000000513C000-memory.dmp

Filesize
624KB

Download
memory/4320-1-0x00000000007D0000-0x0000000000838000-memory.dmp

Filesize
416KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads